FreeBSD git weekly: 2025-09-01 to 2025-09-30

There's no need for an implied value judgement.

Suggested by:   jhb
Reviewed by:    kib, jhb
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D52351

Add kqueue tracking to jails, inspired by how it's done with processes.
EVFILT_JAIL takes a jail ID, and tracks with NOTE_JAIL_SET,
NOTE_JAIL_ATTACH, NOTE_JAIL_REMOVE, and NOTE_JAIL_CHILD. It also uses
the NOTE_TRACK mechanism that EVFILT_PROC uses, using the same result
flags (NOTE_CHILD and NOTE_TRACKERR).

Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D51940

Similar to process descriptors, jail desriptors are allow jail
administration using the file descriptor interface instead of JIDs.
They come from and can be used by jail_set(2) and jail_get(2),
and there are two new system calls, jail_attach_jd(2) and
jail_remove_jd(2).

Reviewed by:    bz, brooks
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D43696

Manpages are very small, and having a separate manpages package for
every base package is quite annoying for users.  Turn this option
off by default.

Discussed with: bapt
Reviewed by:    manu, emaste
MFC after:      3 days
Differential Revision:  https://reviews.freebsd.org/D52417

Fixes:                https://cgit.freebsd.org/src/commit/?id=dd8c666d8b78 ("src.sys.mk: Support src.conf in SRCTOP")

Enabled qat driver support for 402xx device with
ID 0x4944/0x4945. This is an additional device supported
under the existing qat_4xxx driver. Firmwares specific to
the 402xx device are added.

Signed-off-by: Hareshx Sankar Raj <hareshx.sankar.raj@intel.com>

Relnotes:       yes
Sponsored by:   Intel Corporation
MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D52488

We don't want a tests-dev package, because this means set-devel depends
on tests-dev, which transitively depends on tests, which means you can't
install set-devel without also getting tests.

The only real "dev" files in tests-dev are from ATF (libprivateatf),
so move that to its own package and add a dependency from tests.

Also move Kyua to its own package, since this might be useful for
running tests even when the user doesn't want the whole set of base
tests installed.

Add a dependency from -tests to both -atf and -kyua, and a dependency
on -set-base, since the tests won't work without the full base system
installed.

The remaining "dev" files in tests are actually test artifacts, not real
development libraries.  Add a new NO_DEV_PACKAGE option to bsd.lib.mk,
which causes dev files to be installed in the base package instead of
creating a -dev package, and set this option for everything that
installs test libraries.

While here, add a slightly more informative description for the tests
package.

MFC after:      3 seconds
Reviewed by:    bapt, emaste
Differential Revision:  https://reviews.freebsd.org/D52597

Move mandoc to its own package so users can install it independently of
-utilities.  Put the package in the minimal set, since we also ship
manpages in minimal and "man" is a basic Unix utility.

Add a pkg-triggers(5) hook to run makewhatis when new manpages are
installed, so that apropos(1) works.  This depends on a new pkg(8)
feature expected to be in in the upcoming 2.3.2 release; in the mean
time, this is a no-op (i.e., having an older pkg doesn't break anything,
it just won't run the trigger).

MFC after:      3 seconds
Reviewed by:    bapt
Differential Revision:  https://reviews.freebsd.org/D52564

Implement RFC 7217 (A Method for Generating Semantically Opaque
Interface Identifiers with IPv6 Stateless Address Autoconfiguration
(SLAAC)) in our IPv6 stack.

A new ifconfig `stableaddr` flag is added to enable the feature on
interfaces, which defaults to on or off for new interfaces based
on the sysctl `net.inet6.ip6.use_stableaddr` (off by default, so
this commit causes no change in behavior with default settings).

The algorithm follows the RFC in its logic, using SHA256-HMAC as
the algorithm to derive addresses so as to provide code that can
be leveraged by future implentations of RFC 8981, leveraging the
`hostuuid` as the secret.

The source of the hostidentifier can be configured using the sysctl
`net.inet6.ip6.stableaddr_netifsource`, while the number of retries
generating a new address in case of collision can be configured
using the `net.inet6.ip6.stableaddr_maxretries` sysctl (default 3).

Documentation about all these flags is added to the ifconfig(8) man
page.

Reviewed by:            cognet, glebius, hrs
Tested by:              zarychtam@plan-b.pwste.edu.pl
Approved by:            cognet, glebius
Relnotes:               yes
Differential Revision:  https://reviews.freebsd.org/D49681

Nearly everyone wants powerd to manage CPU frequency scaling on real
hardware, even if -utilities isn't installed.  Conversely, very small
jails might want -utilities but don't need powerd.

Move it to its own package and add it to the minimal set.

MFC after:      1 day
Reviewed by:    manu, imp
Differential Revision:  https://reviews.freebsd.org/D52645

Due to the size of libpmc.so.5, this reduces the size of the -utilities
package by 10%.

MFC after:      1 day
Reviewed by:    manu, adrian, emaste
Differential Revision:  https://reviews.freebsd.org/D52662

Currently libbz2 is in the libbz2 package, while bzip2 itself is in
-utilities, which is inconsistent.  Move both the library and the
utility to a new -bzip2 package, and use LIB_PACKAGE to create a
separate -bzip2-lib package for runtime dependencies.

Add the bzip2 package to the minimal set, and since newsyslogd uses
bzip2 for logfile compression, add a dependency from there.

MFC after:      1 day
Reviewed by:    manu
Differential Revision:  https://reviews.freebsd.org/D52663

Sponsored by: The FreeBSD Foundation
Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D52583

While preserving compatibility ('root' implied if no user is specified,
option '-i' not setting groups), introduce options to control finely
which user and group IDs are set in the launched process.

To minimize the risks of user error, mdo(1) by default enforces that all
user and group IDs are specified, either with explicit values from the
command-line or, if a known user name is passed with '-u', from the
corresponding content of the password and group databases.  The other
main type of use cases is to start from the current process'
credentials, only amending part of them.  It is now also possible to
blend both approaches, where some parts must be specified and the others
can just be amended or left as is.

Options:

* As before:
-u: Specifies a user name or ID to change all user IDs to.  If a known
    name is passed, also automatically sets all groups as per the
    password and group databases.
-i: Starts from the current groups, instead of having to specify them
    by using '-u' with a known user name or explicitly.

* New:
-k: Starts from the current users (incompatible with '-u').  Implies '-i'.
-g: Sets/overrides the primary group IDs with the passed group name or ID.
-G: Sets/overrides the supplementary groups set with the passed list of
    comma-separated names or IDs.
-s: Amend the supplementary groups set according to the list of
    comma-separated directives from the following:
    - @: Empties the set.  Must be the first directive.  Incompatible with '-G'.
    - +<group>: Add a group to the set.
    - -<group>: Remove a group from the set.  Takes precedence over +<group>.
--euid: Overrides the effective user ID.
--ruid: Overrides the real user ID.
--svuid: Overrides the saved user ID.
--egid: Overrides the effective group ID.
--rgid: Overrides the real group ID.
--svgid: Overrides the saved group ID.

Option '-k' was introduced as a requirement to be explicit when one
wants to keep the current user(s) instead of specifying new ones.  This
is both for the purpose of avoiding foot-shooting and preserving the
possibility to omit '-u' to switch to 'root'.  In order to avoid
confusion, if any user or group overrides are specified, mdo(1) however
enforces that either '-u' or '-k' has been specified (so, in practice,
'-u root' is implied only in the absence of any other options except
'-i').

Some base supplementary groups set is needed when '-s' is used without
directive '@'.  It can be an explicit one specified with '-G',
effectively meaning that '-G' is processed before '-s'.  Else, it is
determined from the password/group database (see initgroups(3)) if '-u'
with a user name was passed, or is simply the current set if '-i' (or
'-k') was specified.  Other cases require specifying the full set (using
'-G' or '-s' with '@'), and will fail otherwise.

As the release process for 15.0 is progressing, this is committed in
advance of the still-in-progress tests and manual page updates.

Note for MFC to stable/14: As initgroups() has its old behavior,
consistently with it, remove the effective GID from being passed also as
a supplementary group.

Reviewed by:    bapt
MFC after:      3 days
Relnotes:       yes
Event:          EuroBSDCon 2025
Sponsored by:   The FreeBSD Foundation
Sponsored by:   Google LLC (GSoC 2025)
Co-authored-by: Kushagra Srivastava <kushagra1403@gmail.com>
Differential Revision:  https://reviews.freebsd.org/D52613

Both drm-kmod and nvidia-drm were updated to keep compiling and/or
working after the latest LinuxKPI PCI changes.  Some of what should
have worked for a long time but did not or conflicted was hidden
behind native PCI calls instead of using LinuxKPI.  We cleaned this
up.  Bump __FreeBSD_version so that users will get the updated packages.

MFC after:      3 days
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289647

root's home directory was moved to /root many years ago, so there's no
reason to keep this old link.  This brings sh in line with csh, where
/.cshrc was removed in dcb65c5a94d4.

Relnotes:       yes
Approved by:    re (cperciva)
MFC after:      1 day
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289097
Reviewed by:    cperciva, jilles, bapt, emaste
Differential Revision:  https://reviews.freebsd.org/D52161